From 5b41adfd2815f9646cab328a4dd743283f692f55 Mon Sep 17 00:00:00 2001 From: Awilum Date: Sat, 7 Nov 2015 01:41:19 +0300 Subject: [PATCH 01/32] Use Parsedown Parser #370 --- CHANGELOG.md | 6 ++++++ plugins/markdown/markdown.plugin.php | 9 +++++---- 2 files changed, 11 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 03740415..442af88e 100755 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +Monstra 3.0.3, 2015-11-XX +------------------------ +- Improved Monstra Security +- Added Parsedown Parser +- Minimum PHP version for Monstra is 5.3.2 + Monstra 3.0.2, 2015-10-16 ------------------------ - Added Monstra MIT LICENSE instead of GNU GENERAL PUBLIC LICENSE v3 diff --git a/plugins/markdown/markdown.plugin.php b/plugins/markdown/markdown.plugin.php index b4a6270e..64699e4d 100644 --- a/plugins/markdown/markdown.plugin.php +++ b/plugins/markdown/markdown.plugin.php @@ -1,7 +1,7 @@ Date: Sat, 7 Nov 2015 01:41:57 +0300 Subject: [PATCH 02/32] Improve Monstra Security #369 --- .htaccess | 53 +++++++++++++++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 12 deletions(-) diff --git a/.htaccess b/.htaccess index 26fe6dee..3293165d 100644 --- a/.htaccess +++ b/.htaccess @@ -1,13 +1,15 @@ # -# Monstra :: php & apache settings +# This file is part of the Monstra. +# +# (c) Romanenko Sergey / Awilum +# +# For the full copyright and license information, please view the LICENSE +# file that was distributed with this source code. # # Set default charset utf-8 AddDefaultCharset UTF-8 -# Don't show directory listings for URLs which map to a directory. -Options -Indexes - # PHP 5, Apache 1 and 2. php_flag magic_quotes_gpc off @@ -15,20 +17,47 @@ Options -Indexes php_flag register_globals off - -# Setting rewrite rules. RewriteEngine on - # Update code bellow for SEO improvements - # RewriteCond %{HTTP_HOST} ^www.example.org [NC] - # RewriteRule ^(.*)$ http://example.org/$1 [R=301,L] - + ## Begin - Rewrite rules to block out some common exploits. + # If you experience problems on your site block out the operations listed below + # This attempts to block the most common type of exploit `attempts` to Monstra + # + # Block out any script trying to base64_encode data within the URL. + RewriteCond %{QUERY_STRING} base64_encode[^(]*\([^)]*\) [OR] + # Block out any script that includes a - - + + @@ -41,9 +41,9 @@ $('.chocolat').Chocolat({ overlayColor : '#000', - leftImg : "/public/assets/img/chocolat/left.gif", - rightImg : "/public/assets/img/chocolat/right.gif", - closeImg : "/public/assets/img/chocolat/close.gif", + leftImg : "/public/assets/img/chocolat/left.gif", + rightImg : "/public/assets/img/chocolat/right.gif", + closeImg : "/public/assets/img/chocolat/close.gif", loadingImg : "/public/assets/img/chocolat/loading.gif" }); @@ -53,7 +53,7 @@ increaseArea: '20%' }); - }); + }); @@ -65,7 +65,7 @@ -